Free Practice Quiz Question List

1 Cryptography Foundations and Security Goals Online Quiz Questions

Use this free practice quiz with 20 questions to review 1 Cryptography Foundations and Security Goals, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

True or false: Encrypting stored data is enough to ensure that authorized users can access it whenever they need it.

A
True
B
False

Choose one

1 point

A service needs to store user passwords so it can check later whether a submitted password is correct. Which approach best fits this task?

A
Encrypt passwords with a general-purpose encryption algorithm
B
Store passwords using a password-hashing function
C
Store the output of a fast ordinary hash
D
Encode passwords so they can be recovered later

Fill in the blank

1 point

A non-secret value added when hashing a password, helping identical passwords produce different stored results, is called a .

Written response

1 point

What cryptographic term—or standard abbreviation—describes a value used by some encryption schemes that usually need not be secret but must meet the scheme’s requirements?

Choose one

1 point

What does a digital certificate establish, without by itself proving that a particular person controls the key at the moment of use?

A
It is the private key used to sign messages
B
It guarantees that the named person currently controls the corresponding key
C
It binds a public key to an identity or name under an issuing authority's rules
D
It conceals the public key from people who do not have authorization

True or false

1 point

True or false: If two files have the same cryptographic hash, that alone proves who created them.

A
True
B
False

Choose all

1 point

A team is preparing a threat model for an application that handles sensitive records. Which details belong in that model? Select all that apply.

A
Which information or service needs protection
B
Which cryptographic algorithm is most familiar to the development team
C
What an adversary can observe, alter, or control
D
Where data and keys are handled, along with relevant assumptions

Fill in the blank

1 point

When relying on a public key certificate, validate the certificate and the .

Written response

1 point

What is the term for the short value produced by authenticated encryption or a MAC that is checked to detect alteration of protected data or associated metadata?

Choose one

1 point

A developer is configuring an AEAD construction whose rules forbid nonce reuse with a key. Which practice is correct?

A
Keep the nonce secret and reuse it whenever the key is unchanged
B
Follow the construction's nonce requirements, including avoiding reuse with the same key when forbidden
C
Use a public key as the nonce so it can be checked by anyone
D
Choose any nonce value; libraries do not impose requirements on it

Choose all

1 point

A team wants to reduce implementation and operational risks in a cryptographic system. Which practices support that goal? Select all that apply.

A
Use a maintained, well-reviewed library's high-level APIs
B
Write custom cryptographic algorithms to avoid relying on dependencies
C
Restrict access to keys and plan for their rotation and retirement
D
Keep dependencies updated and check verification results

Choose one

1 point

A web application encrypts its database, but the running application can access both the documents and their decryption keys. What is the most accurate assessment if an attacker compromises that application?

A
The database encryption guarantees the documents remain confidential even if the application is compromised
B
The attacker can read the documents only if the database contains no hash values
C
Database encryption may help against backup theft, but may not protect documents from an attacker who controls the running application and its access to keys
D
Encrypting the database guarantees that attackers cannot alter stored documents

Open ended

1 point

An organization encrypts a database containing private documents. The running application can decrypt those documents, and an attacker might either steal a database backup or compromise the application and alter stored documents. Explain what the encryption protects against in each case and what additional protection is needed for unauthorized changes.

Choose one

1 point

A service and its users share a secret key. The service needs to detect whether an attacker has altered a message in transit. Which mechanism directly fits this goal?

A
Encryption without authentication
B
A message authentication code
C
A certificate by itself
D
A salt added to a password hash

True or false

1 point

A valid digital signature can provide evidence that a message was signed by the holder of a particular private key, but it does not by itself conceal the message.

A
True
B
False

Written response

1 point

What is the term for a non-secret, usually unique value added when hashing a password so that identical passwords produce different stored results?

Choose one

1 point

A web application encrypts its database, but the running application can access both the documents and their decryption key. Which conclusion best describes the protection if an attacker compromises the application?

A
It protects the documents even if the running application is compromised.
B
It may not protect the documents because the compromised application can access both the data and the decryption key.
C
It guarantees that stored documents cannot be changed.
D
It ensures authorized users can always access the documents.

Choose one

1 point

An application must encrypt ordinary data and detect tampering. Which approach best meets both requirements?

A
Use a library-supported authenticated encryption construction and reject data if authentication fails.
B
Encrypt the data and accept the decrypted output even if its authentication check fails.
C
Hash the data and use the hash as a decryption key.
D
Use a certificate in place of an encryption algorithm.

Written response

1 point

What is the term for a description of what needs protection, from whom, and under what assumptions?

Choose one

1 point

Which statement accurately describes a certificate?

A
A certificate is the private key used to sign messages.
B
A certificate guarantees that the named person currently controls the key.
C
A certificate encrypts data so that only its issuer can read it.
D
A certificate is a digitally signed document that binds a public key to an identity or name.